Behavioral task
behavioral1
Sample
e68d02f2a5a85f8a9053cc761e6f3bf17ae8c36e2ea0d0c936952e2d656f6708.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e68d02f2a5a85f8a9053cc761e6f3bf17ae8c36e2ea0d0c936952e2d656f6708.exe
Resource
win10v2004-20230220-en
General
-
Target
e68d02f2a5a85f8a9053cc761e6f3bf17ae8c36e2ea0d0c936952e2d656f6708
-
Size
59KB
-
MD5
412c59a3b0e53f76c6d2af43bddae764
-
SHA1
b95cc88cf5321b5c624b5751314dee5ffa1e1d66
-
SHA256
e68d02f2a5a85f8a9053cc761e6f3bf17ae8c36e2ea0d0c936952e2d656f6708
-
SHA512
dd3331f841fdb8ee2ab576ba04bf97e6faff698b20e286142a988c5fb0350bff93c282ba18329cdbf0478b7a32b7a24986cdcf0401166327b23c3cc46c774c48
-
SSDEEP
1536:a7QnrTl1zCiupVmn0S4gQwI1raQZMVWxcYYPxO0dPxmSb:a7QrR12iI0nw1railgxvxmW
Malware Config
Signatures
-
Processes:
resource yara_rule sample aspack_v212_v242
Files
-
e68d02f2a5a85f8a9053cc761e6f3bf17ae8c36e2ea0d0c936952e2d656f6708.exe windows x86
Code Sign
02:6e:6c:75:6c:a2:83:b7:46:6b:c7:ba:6b:e2:be:c9Certificate
IssuerCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1300Not Before27-11-2021 05:19Not After31-12-2023 16:00SubjectCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#13000e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2022 00:00Not After09-11-2031 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23-03-2022 00:00Not After22-03-2037 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before21-09-2022 00:00Not After21-11-2033 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
02:6e:6c:75:6c:a2:83:b7:46:6b:c7:ba:6b:e2:be:c9Certificate
IssuerCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1300Not Before27-11-2021 05:19Not After31-12-2023 16:00SubjectCN=NVIDIA Corporation,ST=Hubei,C=China,1.2.840.113549.1.9.1=#13000c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before21-09-2022 00:00Not After21-11-2033 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23-03-2022 00:00Not After22-03-2037 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2022 00:00Not After09-11-2031 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
f1:aa:b4:bf:33:d2:2c:26:7a:73:1c:7a:2b:1d:d0:73:a5:56:7d:86:e9:99:a8:9b:68:77:7b:47:2e:5c:0a:8dSigner
Actual PE Digestf1:aa:b4:bf:33:d2:2c:26:7a:73:1c:7a:2b:1d:d0:73:a5:56:7d:86:e9:99:a8:9b:68:77:7b:47:2e:5c:0a:8dDigest Algorithmsha256PE Digest Matchestrue32:5f:87:fa:c8:6f:aa:34:19:08:fd:61:d1:b7:33:6f:ca:cf:41:f8Signer
Actual PE Digest32:5f:87:fa:c8:6f:aa:34:19:08:fd:61:d1:b7:33:6f:ca:cf:41:f8Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 24KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 10KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE